KR101358128B1 - Authenticating data units of a mobile communications device - Google Patents

Abstract

The present invention provides a method for authenticating a digital data unit of a mobile communication device. In one embodiment, the present invention provides authentication data to provide a capture of a digital data unit to a mobile communication device and to verify at least one of the source or integrity of the digital data unit.

Digital data units, mobile communications networks, network operators, hashes

Description

Authenticating data units of a mobile communications device

1A and 1B are planar front and plan side views of a mobile communication device constructed in accordance with the present invention;

2 is a block diagram of a mobile communication device constructed in accordance with the present invention.

3A and 3B are flow charts for generating authentication data of a digital signature and providing the signature verification.

4 is a block diagram of a data unit consisting of captured data and corresponding reference data.

5 illustrates an embodiment of the invention for storage of digital data units and digital signatures on a server.

6 is a top plan view of an embodiment of a mobile communication device constructed in accordance with the present invention having two camera modules.

Description of the Related Art [0002]

1 mobile communication device 10 main body

12 display 14 keypad

20: camera module 22: lens

24: flash accessory 26; LED

30: fingerprint detector

The present invention relates generally to mobile communication devices, and more particularly to a method and device for authenticating a digital data unit of a mobile communication device.

Digital photography and other digital media have replaced most of the conventional analog media. This creates a problem of authenticating or verifying that a digitally taken photograph or other digital medium is altered or unchanged. Digital data can be easily replicated or altered using computers and other digital devices. Many software applications that can easily alter digitally captured data even by relatively inexperienced people can use it for video or audio processing. Thus, those who rely on digital photographs or other digital data for actual accuracy may want to prove that the digital data is a genuine article.

For many commercial purposes, the owner of a digital image or audio file is interested in examining whether the image or file has been copied or changed. For example, a television or radio station generally wants to prove the authenticity of a data file if the content or accuracy of the file is in doubt. Entertainers with digital recordings performed with portable communication devices are interested in ensuring that the recordings are not copied or distributed. U.S. Patent 6,628,801, Robert D. In IMAGE MODIFICATION WITH PIXEL MODIFICATION by Powell, et al. (Powell), a method and system are described for inserting signatures in a visual image to survive any image transformation.

In certain areas of interest, such as digital data used as evidence of trial proceedings, there is a need for a system or method for authentication of captured digital data. Powell cannot provide this level of authentication. It is aimed that a valid authentication level for digital data is available for use in a mobile communication device. This is particularly useful because mobile communication devices such as mobile phones and personal digital assistants are carried by the majority of the population.

In addition to mobile phones, other mobile communication devices are multi-functionalized. In addition to being used for voice communication, mobile phones are equipped with applications that provide SMS or MMS background messaging, email and fax services. The mobile phones are generally equipped with a digital device for taking still pictures and moving pictures in short video clips as well as a recording device for capturing a conversation or obtaining voice notes. However, a method or device for authenticating digital data captured by a mobile communication device is not yet known.

Therefore, what is needed in this technology is a new method and device for authenticating digital data, especially digital data captured by mobile communication devices such as mobile phones.

SUMMARY OF THE INVENTION [

In order to address the above deficiencies, the present invention provides a method for authenticating a digital data unit of a mobile communication device. In one embodiment the invention provides a capture of a digital data unit to a mobile communication device and generates authentication data for verifying at least one of the source or integrity of the digital data unit.

The present invention provides a number of embodiments for authenticating a visual, audio or visual and audio digital data unit captured by a mobile communication device. Each such embodiment uses to authenticate that a particular data unit is unchanged and that the data unit was originally captured by the mobile communication device. Thus, an authorized data unit can be used reliably in situations where it is important for the data to be original, such as for insurance claims, trial proceedings, or other similar situations.

One embodiment of the method requires the provision of reference data corresponding to a digital data unit, wherein the reference data includes (i) data representing the date and time at which the digital data was captured; (Ii) data indicative of the location where the digital data unit was captured; (Iii) data certifying the owner of the mobile communication device; (Iii) data identifying the person who captured the digital data; (Iii) data identifying a mobile communication device; (Iii) data identifying a network operator of a mobile communication network to which the mobile communication device can connect; And (iii) various types of reference data groups consisting of data indicative of the position or distance of the object in the visually captured scene in relation to the mobile communication device or in relation to other objects in the visually captured scene. In one embodiment the digital data unit at least partially comprises reference data.

Other embodiments of the present invention provide for the generation of a unique identifier relating to a digital data unit or reference data, or both data by a predefined algorithm. Another embodiment provides that the generation of authentication data includes generating a hash value that occurs in a hash function that is executed on a digital data unit. One embodiment provides for generating authentication data to include encrypting and converting or digitally signing a digital data unit by an encryption algorithm. A feature of this embodiment provides for digitally signing by generating a digital signature from the digital data unit by an asymmetric cryptographic algorithm using the private key of the asymmetric key pair. In one embodiment of the present invention, generating authentication data includes generating a digital signature from a hash value by an asymmetric cryptographic algorithm using a private key of an asymmetric key pair. Of course, the HMAC algorithm can also be used.

A useful embodiment of the present invention provides reference data such that the date and time based on the time base provided by the network operator or the time stamp provided by the service provider includes data representing the date and time captured in the digital data unit. In one embodiment, the time base is NITZ (Network Identity and Timezone) according to 3GPP TS 22.042 V6.0.0.

One feature of the present invention is that a mobile communication device is coupled to a cell-based mobile communication network such that the reference data includes information about neighboring cells at the time the digital data unit is captured. Another aspect is to allow the mobile communication device to connect with the GPS receiver and to have the reference data include information about the geographic location of the mobile communication device at the time the digital data unit is captured. GPS can also be used to provide a time stamp as part of the reference data.

In another embodiment of the invention the mobile communication device has an associated SIM card and the reference data comprises data from the SIM card that clearly identifies the owner and / or the network provider of the mobile communication device, the mobile communication device to the network provider. Is connected. In another embodiment, the invention provides a capture of fingerprint data of a person operating a mobile communication device when a digital data unit is captured, the fingerprint data being included in reference data. In another embodiment, the present invention provides a capture from different viewpoints of at least two images of a visually captured scene and includes at least one object in the scene in relation to a mobile communication device or in relation to another object in the scene. Determine a location or distance within the information, the information being included in the reference data.

Another embodiment provides reference data that includes a certificate that explicitly identifies a mobile communication device. In another embodiment, data is transmitted to a database server, the transmitted data comprising: a digital data unit; Reference data; A unique identifier generated based on the digital data unit and / or the reference data; A hash value generated by executing a hash function on the digital data unit; And a digital signature generated from the digital data unit by an asymmetric cryptographic algorithm using the private key of the asymmetric key pair. In another embodiment, the present invention includes authenticating a digital data unit with authentication data.

The invention in one embodiment comprises: (1) means for capturing a digital data unit; And (2) means for generating authentication data to verify at least one of the source or integrity of the digital data unit. One aspect of this embodiment provides a means for providing reference data corresponding to a digital data unit, the reference data comprising (i) data indicative of the date and time at which the digital data unit was captured; (Ii) data indicative of the location where the digital data unit was captured; (Iii) data identifying the owner of the mobile communication device; (Iii) data identifying the person who captured the digital data unit; (Iii) data identifying a mobile communication device; (Iii) data identifying a network operator of a mobile communication network to which the mobile communication device is connected; And (iii) data indicative of object position or distance in the visually captured scene in relation to the mobile communication device or in relation to other objects in the visually captured scene.

The present invention provides some other embodiments of a device for performing the above described methods. These devices will be readily understood by those skilled in the art from the method described above.

The foregoing describes preferred and optional features of the invention to enable those skilled in the art to better understand the detailed description of the invention that follows. Additional features of the invention are described below and form the subject of the claims of the invention. Those skilled in the art should recognize that the conception and specific embodiment disclosed may be readily used as a basis for designing or modifying other structures for carrying out the same purposes of the present invention. Those skilled in the art should realize the equivalent structures without departing from the spirit and scope of the invention.

Reference is made to the following descriptions made in connection with the accompanying drawings for a more complete understanding of the invention.

Before describing the drawings, various aspects, embodiments, and features of the invention will be described. The present invention provides a method and device for capturing digital visual, audio or visual and audio data and authenticating the captured data with a mobile communication device. For such applications, digital data units are digital visual and / or audio data that contain or form digital images, digital video sequences, digital audio sequences, or any combination. Thus, the image or images, audio recordings, video or video clips, or any combination of the above, form a digital data unit. Thus, one embodiment of the invention provides for using a mobile communication device to capture a digital data unit and generating authentication data for verifying the source or integrity of the digital data unit. The present invention allows a user of a mobile communication device to capture digital visual, audio, or audio visual data and later to verify authentication of the captured data. The generation of authentication data may be performed by the mobile communication device itself or by an independent device.

Additional information is typically needed to provide authentication for digital data. Therefore, the present invention allows the reference data to be secured for authentication, which reference data will correspond to and authenticate the captured visual and / or audio digital data unit. Other types or types of reference data of a wide range of modifications may be used for authentication. Although some of these various types of reference data are described herein, the invention is intended to include any other type of reference data that may be suitable without being limited to them and not known or found later.

Particularly useful reference data will include data associated with the date and time the visual and / or audio data was captured. Preferably this is based on a safe time base of steering and in one embodiment is provided by a network operator. A particularly suitable time base is NITZ (Network Identity and Timezone) according to 3GPP TS 22.042 V6.0.0. NITZ messages are used to convey network identification and time information from the network operator to the mobile communication device, which information is commonly comprised of year, month, date, time, minute, second, time zone, and daylight savings time (DST). It will be in the format of time (UT).

The reference data may include data indicative of where the visual and / or audio data was captured. In one embodiment of the invention, the location is determined by a mobile communication device connecting to a cellular network to protect information about neighboring cells at the capture time of visual and / or audio data. This information can be accurately reproduced later in time and used to verify the data capture position.

If a more accurate data capture location is provided, another embodiment allows a GPS receiver to be associated with the mobile communication device. Based on the GPS data received at the visual and / or audio data capture time, precise reference data is collected in relation to the capture time as well as the geographic location of the capture.

Mobile communication devices, such as mobile phones, typically include Subscriber Identity Module (SIM) cards that contain network provider and subscriber information. In one embodiment of the invention, the reference data includes data from the SIM card to clearly identify the subscriber or owner of the network provider for the mobile communication device and / or the mobile communication network to which the mobile communication device is connected.

Since a mobile communication device can be used by its owner and others, one embodiment of the present invention provides for the capture of data regarding the actual user of the device at the time of capture of visual and / or audio data. Particularly suitable for this purpose is the capture of biometric data about the user. Thus, one embodiment of the present invention allows a mobile communication device to have means for capturing biometric data of a user. One but not one said means may be a fingerprint detector for capturing fingerprint data of a person operating a mobile communication device at the time visual and / or audio data is captured.

When visual data is captured, one embodiment of the present invention provides for capturing at least two images of a scene from different viewpoints. An advantage of this embodiment is that information regarding the location or distance of at least one object in the scene relative to the mobile communication device or other object in the scene can be determined. These two images can be captured sequentially with one camera or simultaneously if two cameras are used. In one embodiment the mobile communication device has two cameras for this purpose.

The reference data may include a certificate for clearly identifying the mobile communication device. The certificate will preferably be "owned" by the mobile communication device; That is, it will identify individual devices stored in and stored within the device. The validity of a certificate may be based on the subscription for which the certificate is valid at a particular time. Subscription may be provided by the network operator or the manufacturer of the device, for example. The subscription is valid for the lifetime of the device based on the serial number of the device and may be hardcoded into the device circuit.

In one embodiment, a method of providing authentication data provides for the generation of a unique identifier. The unique identifier may be generated with a predefined algorithm, where the input parameters of the algorithm depend on the captured data and / or corresponding reference data. For example, a digital image taken with a camera module of a mobile communication device can be combined with corresponding reference data such as network operator information and system time to generate a unique identifier that can be used to digitally sign the image. It is desirable for the predefined algorithm to provide a unique identifier that is different from any other unique identifier generated based on other captured data or reference data. In order to prevent the predefined algorithm from changing, in one embodiment the algorithm is securely stored in the mobile communication device. When an algorithm is known as a trusted entity, the authentication of the captured data and any reference data used to generate the unique identifier can be verified by the trusted entity, which trusted entity is for example a network operator or Device manufacturer.

A suitable algorithm may be a hash function that, when executed on a digital data unit, generates a hash value, the digital data unit comprising captured visual and / or audio data optionally appended by any of the reference data described above. The hash value passed by the hash function typically has a fixed data length independent of the length of the input data. In addition, the hash function used is unidirectional, making it difficult to invert the hash function. In other words, the one-way hash function H means that it is difficult to find some input x in computation such that H (x) = h given the hash value h. Preferably the hash function makes it difficult to computationally find an input y that is not equal to the input x so that H (x) = H (y), in particular H (x) = H (y). There is no collision so that the two inputs x and y are difficult to find computationally. The hash value is a concise representation of the digital data unit on which the hash function is executed. Any known hash function may include message digest algorithms (MD2, MD4 or MD5); Secure hash algorithm (SHA); RACE Integrity Raw Evaluation Message Summary (RIPEMD-160); Or in creative methods, such as so-called Tiger or Whirlpool algorithms.

Generating the authentication data includes encrypting and converting or digitally signing the digital data unit by an encryption algorithm. The digital signature means is to generate a digital signature from digital data by an asymmetric cryptographic algorithm using a private key of an asymmetric key pair. The advantage of using an asymmetric cryptographic algorithm is that the public key of the asymmetric key pair is required for verification. The cryptographic algorithm used to generate the digital signature preferably does not know the private key and does not allow it to generate a digital signature that takes into account its validity when verified by the public key.

Generating authentication data includes generating a digital signature from a hash value, the hash value being generated as described herein, and the asymmetric cryptographic algorithm using a private key of an asymmetric key pair. Digitally signing the digital data unit itself is faster because digitally signing the hash value of the digital data unit is faster than performing a cryptographic algorithm to generate a digital signature that is typically based on a private key. Faster than The digital signature generated by the corresponding cryptographic algorithm is typically smaller in size than the data unit to be signed. Thus, because the hash value has a defined data length, regardless of the length of the data unit on which the hash function is executed, digitally signing the hash value digitally signs the digital data unit that forms the captured data as a whole. Make digital signatures shorter than Cryptographic algorithms suitable for generating digital signatures include, but are not limited to, the digital signature algorithm DSA based on the RSA (Rivest / Shamir / Adleman) algorithm and the ElGamal method.

In order to later reference or authenticate the captured data, the present invention includes transmitting the data to a database server. The transmitted data may be digital data units that form the captured visual and / or audio data and any corresponding reference data. From a digital data unit by an asymmetric cryptographic algorithm using a unique identifier generated based on the digital data unit and / or reference data, a hash value generated by executing a hash function on the digital data unit, or a private key of an asymmetric key pair. The generated digital signature can all be sent to the server for long time storage. The data transfer from the mobile communication device to the database server may be performed via a mobile communication network to which the device is accessible, or optionally the data may first be transferred from the mobile communication device to the user's computer and then to the database server via the Internet.

Another method for generating authentication data is to pass the digital data captured by the mobile communication device to a database server of a trusted entity and combine the capture data on the server with the corresponding reference data provided by the trusted entity. Reference data includes, for example, information about the subscriber to which the captured is delivered and the date and time at which the data is received by the server. In order to prevent the alteration of the captured digital data as much as possible when the data is not encrypted, the captured data can be automatically sent to the database server without the user ever having access to the captured data.

In most cases, encryption provides a fairly high level of security for the captured data. To provide this higher level of security, the verification process may be slightly different from the previously described variants. When a unique identifier is generated by a predefined algorithm based on some form of reference data such as captured data and capture time for verification, authentication of the captured data and reference data is performed by a trusted entity whose algorithm is known. This is proved if the same unique identifier is identified when running again. When using digital signatures based on asymmetric cryptographic algorithms, the use of the private and digital signatures and public keys of an asymmetric key pair is provided if a digital data unit is generated by performing a known cryptographic algorithm on a digital signature using the public key. Matching with the digital data unit is provided for verification, and authentication of the provided digital data unit is proved. When digitally signing the hash value of the digital data unit for verification, the digital data unit, the digital signature of the hash value and the public key are provided. If the hash value generated by executing a known hash function in the provided digital data unit matches the hash value generated by performing a known cryptographic algorithm on the digital signature using the public key, the authentication of the provided digital data unit is proved.

The asymmetric key pair may correspond to a person, such as the owner of the mobile communication device, or the mobile communication device itself. In order to verify that the provided public key actually corresponds to the claimed person or device, a certificate is provided and includes at least a public key with information about the person or a device belonging to that person. The certificate may be issued by a trusted entity that uses it as a Certificate Authority (CA), such as a network operator or manufacturer of the mobile communication device to which the owner subscribes. Typically, in public key infrastructures (PKI), the certificate will include the digital signature of the certificate issuer.

In one embodiment of the invention, a mobile communication device comprises: capture means for capturing visual and / or audio data, means for providing at least one digital data comprising visual and / or audio data captured by the capture means. And means for generating authentication data for causing the receiving portion of the digital data unit to verify the source and / or integrity of the digital data unit. The invention described herein may be used in PDAs or MDA style devices or any other kind of mobile communication devices, as well as mobile phones or smart phones, now known or later discovered or developed.

The capturing means may comprise one or more camera modules provided for capturing digital images; A camera module provided for capturing digital video sequences; Or an audio recording module comprising a microphone provided for capturing digital audio sequences. The mobile communication device further comprises means for providing reference data corresponding to the visual and / or audio data captured by the capture means. Such reference data may be one or more of any type other than the reference data described above, as well as any other data that may be used to correspond in any manner to the captured data.

In order to prove the authenticity of the captured data, some other kind of reference information or conditions may need to be known and captured. Reference data of this kind may include information about one or more of the following types, i.e., where the data was captured; When data is captured; The person who captured the data; Authentication of the device from which the data was captured; Or authentication of the captured data. Accordingly, the present invention preferably provides a mobile communication device comprising means for providing the reference information. Thus, the mobile communication device will include means for providing a current date and time. In order to provide the current date and time, the steering security time base provided by the network operator based on the Network Identity and Timezone (NITZ) according to 3GPP TS 22.042 V6.0.0 to receive and use NITZ messages sent by the network provider. It can be used in the provided mobile communication device.

In order to provide location information, the present invention includes an embodiment that provides means for determining cell information regarding an accessible cellular network. Even more precise location information may be provided if the device includes a GPS receiver to determine the geographic location of the device and / or the time at which the data was captured.

Another embodiment provides information for identifying the owner of the device and / or identifying the network operator, which information may be received from a SIM card integrated into the mobile communication device. In order to provide information regarding user identification of a mobile communication device other than the owner identified in the SIM card, in one embodiment the invention includes means for capturing biometric data of the user. One way in which the biometric data can be captured is to require a user to provide a fingerprint and mount a device with a fingerprint detector to collect the fingerprint. In one embodiment the fingerprint detector is integrated into the shutter release of the camera module to automatically capture the fingerprint when the camera module is activated.

In another embodiment of the present invention, the capturing means of the mobile communication device comprises two camera modules arranged for capturing digital images from different viewpoints. This information can determine the spacing relationship between visually captured objects.

In order to generate data for authentication of the captured data, one embodiment of the present invention provides a means for generating a unique identifier from a digital data unit and / or corresponding reference data by using a predefined algorithm stored in a device's memory. To provide. Preferably, the user will not have access to the device memory to prevent or possibly change. In many cases mobile communication devices are equipped for protection against the coordination because protection is required by the ETSI standards to provide a secure platform.

In order to ensure a high security standard, an embodiment of the present invention provides a mobile communication device having a cryptographic module provided for encrypting and converting a digital data unit capable of generating a hash value by using an asymmetric cryptographic algorithm as described above. to provide. Since the captured data is generally linked to a mobile communication device than one person, the device may have a digital certificate to clearly identify the device, the certificate may be issued by the manufacturer of the device, The details have been described above.

With reference to the above discussion regarding the information or conditions necessary to provide authentication, the data regarding authentication may be described in the GSM / GPRS neighbor cell report or GPS data to authenticate the location where the data was captured and / or the time at which the data was captured. May be provided by The data captured location can be authenticated by using a pilot security time base such as, for example, NITZ or world clock structure used by the networks to provide accurate time data to mobile phones. The party capturing the data can be ratified by using biometrics to derive parameters from the SIM card of the device capturing the data or to identify the user. Authentication of the device can be ensured by using a personal device owning certificate. The basic need for authenticating the captured data can be accomplished by the mobile communication device itself, in which the data to be authenticated is combined with a device certificate, as well as other protection methods discussed herein.

For long time storage and later reference, the authentication of the captured data can be sent to the database server. One embodiment of the present invention provides a mobile communication device comprising (1) a mobile communication device as described herein; (2) optionally (a) reference data, (b) a unique identifier generated based on the digital data unit and / or reference data, (c) a hash value generated by executing a hash function on the digital data unit, and ( e) a database for receiving and storing digital data units of visual and / or audio data captured by a mobile communication device to which a digital signature generated from the digital data unit is attached by an asymmetric cryptographic algorithm using a private key on the asymmetric key. server; And (3) communication networks to which the mobile communication device and the database server are connectable. The communication network preferably supports at least Global Systems for Mobile communications (GSM) and / or Universal Mobile Telecommunication System (UMTS) protocols, but the invention is not limited to GSM or UMTS but any other communication now known or later discovered. Network and suitable devices.

In order to provide easy implementation and / or specific adaptation of the invention, a digital such as microchip comprising electronically readable control instructions provided for carrying out any of the embodiments of the invention described above when inserted into a mobile communication device. Storage media are proposed. Accordingly, the present invention proposes a digital storage medium consisting of electronically readable control instructions for controlling a communication device provided for executing one process, and (1) visual and / or as a capturing means of a mobile communication device. Capturing audio data; (2) providing at least one digital data unit comprising captured visual and / or audio data; And (3) generating authentication data allowing for clear demonstration of the source and / or integrity of the data unit. The process includes providing reference data corresponding to the visual and / or audio data. The control instructions include at least one cryptographic algorithm provided for generating a digital signature.

1A and 1B, a planar front view and a planar side view of a mobile communication device 1 constructed in accordance with the present invention are shown. The illustrated mobile communication device 1 is a mobile phone having a main body 10 formed for use with one hand. The illustrated mobile phone has a user interface that includes a keypad 14 and a display 12. In order to capture digital images, the mobile communication device 1 has a camera module 20 suitably applied. The camera module 20 shown has a self-timer connected to the lens 22, flash accessory 24 and LEDs 26 indicating the time-lapse for the self-timer. As shown in FIG. 1B, the camera module faces the back side of the mobile telephone mobile communication device that allows the image to be captured on the display 12 to be previewed. In order to identify the user biometrically, the mobile communication device 1 has a fingerprint detector 30. The fingerprint detector 30 is preferably integrated into a key or button used as a shutter release for the integrated camera module 20.

2, a block diagram of a mobile communication device 1 constructed in accordance with the present invention is shown. For data communication, the mobile communication device 1 has a communication transceiver 44. The illustrated embodiment has a GPS receiver 42. The communication transceiver 44 is provided to communicate with the cellular network 300 and the GPS receiver 42 receives the data and time from the four GPS satellites 301, 302, 303 and 304 by means of the geographic location of the mobile communication device 1. Is provided to determine.

The mobile communication device 1 is controlled by the microcontroller 50 executing the arithmetic software stored in the device memory 75. Software is provided to perform a process for capturing visual and / or audio data. In order to capture a digital data image, the mobile communication device 1 has a camera module 20. The mobile communication device 1 has a microphone 60 to provide at least one digital audio sequence.

3A and 3B show flow diagrams for generating authentication data of a digital signature and providing authentication of the signature. The mobile communication device 1 processes the reference data to correspond with the captured visual and / or audio data. In one embodiment of the invention, the reference data comprises information regarding the geographic location of the device 1 at the time visual and / or audio data is captured, the location being derived from the GPS data from the GPS receiver 42. do. The reference data may consist of data identifying the owner of the mobile communication device 1 from the SIM memory 70. To identify the person who captured the visual and / or audio data, the reference data may include biometric information about the user, such as the user's fingerprint, provided by the fingerprint detector 30. Date and time information regarding visual and / or audio data is captured by a clock function integrated in the device. Preferably, the exact time provided by the network operator or steering security time similar to NITZ will be used to provide reference data indicative of the capture date and time of visual and / or audio data.

Referring to Fig. 4, a block diagram of a data unit composed of captured data and corresponding reference data is shown. Software for controlling the mobile communication device 1 is used to provide at least one digital data unit 400 consisting of captured visual and / or audio data along with any applicable reference data. In FIG. 4, the digital data unit 400 includes digital image data 410 captured by the camera module 20; Digital audio data 420 captured by microphone 60; GPS data 430 provided by the GPS receiver 42; NITZ data 440 obtained from a NITZ message received from a network operator via the cellular network 300; And subscriber information data 450 identifying the owner of the mobile communication device 1. Other digital data information, such as information collected from infrared or radar sensors, is included in the digital data unit 400 and is within the scope of the present invention as intended.

Referring again to FIG. 2, in order to generate authentication data that allows source and / or integrity verification of the digital data unit 400, the mobile communication device 1 performs a cryptographic module 65 for performing cryptographic changes of digital data. ). For encryption, the private key 80 of the asymmetric key pair is stored in nonvolatile device memory 75 and protected for user access. The key pair is issued, for example, by the manufacturer of the mobile communication device 1. A device certificate 85 is also stored in the device memory 75, the certificate containing information that clearly identifies the mobile communication device 1 as well as the private key of the asymmetric key pair, which certificate 85 is sent to the manufacturer. May be issued.

Referring again to FIGS. 3A and 3B, further authentication of digital data unit 400 may be accomplished by digital signature 550. To prevent any manipulation of the capture data or the reference data, the digital signature 550 is used to capture the reference data 430, 440, 450 of the image and / or audio data 410, 420 and the digital data unit 400. It is protected immediately after combination with.

Digital data unit 400 will typically consist of a large amount of data, although for example it may consist only of a single digital image with a resolution of one megapixel with reference data (a color depth of one byte per pixel). Assume that the digital data unit will have a data length of at least one megabyte). Although this data length is reduced by compression (which is also within the intended range of the present invention), the digital data unit 400 will still have a significant size. In this case the final digital signature will be essentially the same size as the digital data unit itself.

Thus, one embodiment of the present invention provides a hash function 510 stored in an encryption module 65 that is executed in the digital data unit 400 to form a hash value 520. This hash value 520 is digitally signed using the signature function 530 in combination with the private key 80 that causes the digital signature 550. For later authentication, this digital signature 550 is stored or passed along with a third party along with a copy 400 'of the digital data unit 400.

3B shows a process for providing authentication of the digital data unit 400 "by using the digital signature 550 to form whether or not the digital data unit 400" is the same copy as the original. In combination with the public key 90, the inverse signature function 540 can be used to convert the digital signature 550 back to a hash value 520 ′ equal to the hash value 520. The second hash value 520 "is generated by executing a known hash function 510 on the digital data unit 400". If comparison 580 generates a hash value 520 'that matches a hash value 520 ", then authentication of digital data unit 400" is verified (590). Accordingly, since the digital signature 550 has been generated, it can be set that the capture data and the corresponding reference data in the digital data unit 400 "are not changed. Thus, the source and / or of the digital data unit 400" is not changed. Or integrity may be established.

Although not shown, the certificate 90 stored in the mobile communication device memory 75 is preferably passed along with the digital data unit 400 'and the digital signature 550 so that the certified public key can be used in the authentication process. .

In order to provide a date and time for visual and / or audio data to be captured, a timestamp is used, which timestamp can be provided by an independent trusted entity. For example, the digital data unit, the digital signature of the digital data unit, or the digital signature of the digital data unit hash value can be time stamped by the entity. The time stamping of a digital data unit consists of, for example, attaching the date and time information to the digital data unit and encrypting the resulting data unit with the private key of an asymmetric key pair belonging to the trusted entity on which the time stamping is performed.

5 shows a flowchart of the invention for storage of digital data units and digital signatures on a server. Because permanent storage of captured data and associated digital signatures on the mobile communication device 1 due to limited memory capacity is not always practical, an embodiment of the present invention is a database server (or server) via a cellular network 300 (see FIG. Provide a digital data unit 400 ′ and a digital signature 550 to be delivered to 600. Database server 600 may be provided by a network operator or any other suitable administrator. The illustrated embodiment shows a database server 600 having a communication server 610 connected to an independent database 620 with sufficient storage capacity for long time storage of data captured by multiple users.

Referring to FIG. 6, a top plan view of an embodiment of a mobile communication device constructed in accordance with the present invention having two camera modules 210, 220 is shown. The first camera module 210 and the second camera module 220 are shown, and their respective camera modules 210, 220 can rotate about their respective rotation axes 710 and 720 (one embodiment). In the example, it can be rotated automatically). These two camera modules 210 and 220 allow two digital images of the same scene to be simultaneously captured from several viewpoints in which a stereoscopic image is generated. This allows the data to be generated to indicate the position or distance of the object in the visually captured scene in relation to the mobile communication device 1 or in relation to other objects in the scene. Such data may be incorporated into the digital data unit 400 as reference data. Information about the relative positions of objects in the visually captured scene may be particularly desirable when collecting evidence of a street accident or crime scene.

Although the invention has been described in detail, it should be understood that those skilled in the art can make various changes, substitutions and alterations in the broadest form without departing from the spirit and scope of the invention.

The present invention has the effect of providing new methods and devices for authenticating digital data, in particular digital data captured by mobile telephone devices such as mobile phones.

Claims (10)

A method for authenticating a digital data unit of a mobile communication device, the method comprising: Capturing the digital data unit with a mobile communication device; Generating authentication data to verify at least one of the source or integrity of the digital data unit; Capturing biometric data identifying a person who captured the digital data unit; Appending the biometric data to the digital data unit to provide reference data corresponding to the digital data unit, wherein the reference data is: Data indicative of the date and time at which the digital data unit was captured; Data indicating a location at which the digital data unit was captured; Data identifying an owner of the mobile communication device; Data identifying the mobile communication device; Data identifying a network operator of a mobile communication network to which the mobile communication device is connectable; And The biometric data further comprising data selected from the group consisting of data indicative of the position or distance of the object in the visually captured scene, relative to the mobile communication device or to another object in the visually captured scene. Attaching; And Capturing at least two images of a visually captured scene from different viewpoints, at a location or distance of at least one object in the scene, relative to the mobile communication device, or relative to another object in the scene. Determining information relating to the request, and including the information in the reference data. The method of claim 1, wherein the digital data unit at least partially comprises the reference data. 2. The method of claim 1, wherein generating the authentication data comprises generating a unique identifier in association with the digital data unit by a predefined algorithm. The method of claim 1, wherein generating the authentication data comprises generating a unique identifier in association with the reference data by a predefined algorithm. 2. The method of claim 1, wherein generating the authentication data further comprises generating a hash value resulting from a hash function executed for the digital data unit. 6. The method of claim 5, wherein generating the authentication data comprises generating a digital signature from a hash value by an asymmetric cryptographic algorithm using a private key of an asymmetric key pair. 2. The method of claim 1, wherein generating the authentication data comprises encrypting and converting or digitally signing the digital data unit by an encryption algorithm. 8. The method of claim 7, wherein digitally signing comprises generating a digital signature from the digital data unit by an asymmetric cryptographic algorithm using a private key of an asymmetric key pair. The method of claim 1, wherein the reference data includes a certificate that explicitly identifies the mobile communication device. In a communication system: A communication network connectable to a mobile communication device and a database server, The mobile communication device, Means for capturing a digital data unit; Means for generating authentication data to verify at least one of the source or integrity of the digital data unit; Means for capturing biometric data identifying a person capturing the digital data unit; And Means for providing reference data attached to the digital data unit, the reference data includes the biometric data, and the reference data, Data indicative of the date and time at which the digital data unit was captured; Data indicating a location at which the digital data unit was captured; Data identifying an owner of the mobile communication device; Data identifying the mobile communication device; Data identifying a network operator of a mobile communication network to which the mobile communication device is connectable; And Further comprising data selected from the group consisting of data indicative of the position or distance of the object in the visually captured scene, relative to the mobile communication device, or relative to another object in the visually captured scene, The database server is: A digital data unit comprising at least one of visual and audio data captured by the mobile communication device, the digital data unit optionally appended with the reference data corresponding to at least one of the visual and audio data; The reference data corresponding to at least one of the visual and audio data; A unique identifier generated based on at least one of the digital data unit and the reference data; A hash value generated by executing a hash function on the digital data unit; And Means for receiving and storing data relating to an item selected from the group consisting of a digital signature generated by the digital data unit by an asymmetric cryptographic algorithm using a private key of an asymmetric key pair.

Images